FDA Revised Guidance on Off-The-Shelf Software Use: Maintenance and Obsolescence – RegDesk

Table of Contents

The Food and Drug Administration (FDA), or the Agency, the US regulating authority in the sphere of healthcare products, has published a guidance document dedicated to the off-the-shelf (OTS) software used in medical devices. The document provides an overview of the applicable regulatory requirements, as well as additional clarifications and recommendations to be taken into consideration by medical device manufacturers and other parties involved in order to ensure compliance therewith.

At the same time, provisions of the guidance are non-binding in their legal nature, and they are not meant to introduce new rules or impose new obligations. Moreover, the authority explicitly states that an alternative approach could be applied, provided such an approach complies with the underlying legislation and has been agreed upon with the authority in advance. 

The scope of the guidance covers, inter alia, general considerations for OTS software provided as an appendix thereto in order to provide additional background information the parties responsible for medical devices would benefit from when working on applications related to medical devices incorporating OTS products. This includes aspects related to the maintenance and obsolescence of medical devices. 

In particular, the document outlines the most important aspects concerning the maintenance and obsolescence of medical device software, especially those containing OTS software components. The document provides additional clarifications with respect to product development, which generally results in highly integrated components, and maintenance activities, which may disrupt this integration, potentially affecting structure integrity.

Safety Concerns and Design Implications

According to the document, maintenance activities, especially the introduction of new or modified OTS software components, can significantly influence the safety of a medical device. Therefore, a comprehensive safety impact assessment is necessary, and its findings should be included in a Risk Management File in line with FDA guidelines related to the matter.

Key questions to be addressed in the submission include the traceability of risk assessments to design requirements and test reports, the isolation of safety functions from new OTS software components, the impact the software in question is expected to have on system safety integrity, and new human factors introduced. It is also important to mention that the human factors and special considerations associated with them are described in detail in a separate guidance document issued by the FDA. 

As explained by the authority, adding or modifying OTS software components in a  standard product may introduce significant changes in various aspects such as system resource requirements, timing considerations, memory organization, and new human factor issues. Consequently, the submissions should describe how these changes would affect performance characteristics, the operational environment, and whether data integrity is maintained.

Verification, Validation, and Installation

The document emphasizes the importance of verification and validation activities to be performed each time maintenance modifications take place. In particular, the authority recommends carrying out full system regression testing due to the complexities and unknown logic paths introduced by new OTS software components. Detailed test reports should provide objective evidence that all identified hazards, both at the system and component levels, have been adequately addressed in order to ensure the safety of patients.

According to the document, changes in OTS software components could affect installation requirements. These changes could range from minor adjustments in documentation to significant upgrades. As explained by the FDA, the submission should clarify the impact of these new or modified OTS components on devices that are already in use.

Software Obsolescence

The technology development supported by market demand and economic factors gives rise to the issue of software obsolescence. The authority additionally emphasizes that an OTS software component integrated today may become obsolete in a short period, creating risks for ongoing support for products placed on the market. Thus, submissions should describe in detail the availability of older OTS components, provide a retirement plan for them, and indicate the possibility of OTS component replacement in devices already in use in order to ensure their proper performance as well as the safety of patients. 

According to the guidance, the submission should provide answers to the following questions:

• Will the old OTS software component(s) still be available for fielded medical devices? 
• Is there a retirement plan for OTS software component(s) to be replaced/eliminated?
• Do new OTS software components replace fielded components? 

Product Configuration

As explained by the authority, every submission should clearly specify the product configuration. This includes, inter alia, detailing the hardware and software platforms, listing all OTS components, and any internally developed applications. 

Under the general rule, the parties responsible for medical devices are expected to comply with the Quality System Regulations, including requirements for Design Control (21 CFR 820.30) and Corrective and Preventive action (21 CFR 820.100), throughout the product’s life cycle.

In summary, this document provides comprehensive guidance on the main concerns and regulatory requirements related to the maintenance and obsolescence of medical device software. The guidance describes in detail a framework introduced in order to ensure the safety and proper performance of medical devices, especially those employing OTS software components, throughout their lifecycle.

Sources:

https://www.fda.gov/regulatory-information/search-fda-guidance-documents/shelf-software-use-medical-devices

How Can RegDesk Help?

RegDesk is a holistic Regulatory Information Management System that provides medical device and pharma companies with regulatory intelligence for over 120 markets worldwide. It can help you prepare and publish global applications, manage standards, run change assessments, and obtain real-time alerts on regulatory changes through a centralized platform. Our clients also have access to our network of over 4000 compliance experts worldwide to obtain verification on critical questions. Global expansion has never been this simple.